ChatGPT Internal Artifactory Metadata Channel Enabled Cross-Account Gmail Exfil via Planted Prompts

The attack required the prompt to be planted first through paste, shared chat, or custom GPT builder instructions. Once present, a normal user query triggered dual execution in Thinking mode: visible response plus covert task that read Gmail via connected app tokens and wrote results to Artifactory file properties. The channel worked because read credentials also permitted property writes and no account separation existed on the internal package service.

OpenAI defaults grant Important actions permission to connected apps, allowing reads without user prompts. The small Talked to Gmail label was the only indicator. This pattern matches prior supply-chain abuses where internal developer services become covert channels when environment variables expose write access to shared metadata stores.

OpenAI disabled the Artifactory property service after disclosure. No user patch exists. Similar container-to-container leakage risks remain in other LLM platforms that route package fetches or tool calls through centralized internal infrastructure without per-account isolation.

Administrators should audit connected app scopes and switch to Always ask mode. Enterprise deployments must enforce per-app action restrictions rather than relying on default container boundaries.